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Abstract. In this survey paper we give an intuitive treatment of the 
discrete time quantization of classical Markov chains. Grover search and 
the quantum walk based search algorithms of Ambainis, Szegedy and 
Magniez et al. will be stated as quantum analogues of classical search 
procedures. We present a rather detailed description of a somewhat sim- 
plified version of the MNRS algorithm. Finally, in the query complexity 
model, we show how quantum walks can be applied to the following 
search problems: Element Distinctness, Matrix Product Verification, Re- 
stricted Range Associativity, Triangle, and Group Commutativity. 



1 Introduction 

Searching is without any doubt one of the major problems in computer science. 
The corresponding literature is tremendous, most manuals on algorithms include 
several chapters that deal with searching procedures [22ll4j . The relevance of 
finite Markov chains (random walks in graphs) to searching was recognized from 
early on, and it is still a flourishing field. The algorithm of Aleliunas et al. [1] 
that solves s-t connectivity in undirected graphs in time 0{n^) and in space 
O(logn), and Schoning's algorithm [33| that provides the basis of the currently 
fastest solutions for 3-SAT are among the most prominent examples for that. 

Searching is also a central piece in the emerging field of quantum algo- 
rithms. Grover search [16| , and in general amplitude amplification [11] are well 
known quantum procedures which are provably faster than their classical coun- 
terpart. Grover 's algorithm was used recursively by Aaronson and Ambainis [2] 
for searching in grids. 

Discrete time quantum walks were introduced gradually by Mever [27l28j 
in connection with cellular automata, and by Watrous in his works related 
to space bounded computations [37]. Different parameters related to quantum 
walks and possible specdups of classical algorithms were investigated by several 
researchers 130181312911915^ . 

The potential of discrete time quantum walks with respect to searching prob- 
lems was first pointed out by Shenvi, Kempe, and Whaley [34] who designed 
a quantum walk based simulation of Grover search. Ambainis, in his seminal 
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paper [7], used quantum walks on the Johnson graphs to settle the query com- 
plexity of the Element Distinctness problems. Inspired by the work of Ambainis, 
Szegedy [35] designed a general method to quantize classical Markov chains, and 
developed a theory of quantum walk based search algorithms. A similar approach 
for the specific case of searching in grids was taken by Ambainis, Kempe and 
Rivosh [S^ . The frameworks of Ambainis and Szegedy were used in various con- 
texts to find algorithms with substantial complexity gains over simple Grover 
search |26I12I23I15| . In a recent work, Magniez, Nayak, Roland and Santha [25] 
proposed a new quantum walk based search method that expanded the scope 
of the previous approaches. The MNRS search algorithm is also conceptually 
simple, and improves various aspects of many walk based algorithms. 

In this survey paper we give an intuitive (though formal) treatment of the 
quantization of classical Markov chains. We will be concerned with discrete time 
quantum walks, the continuous case will not be covered here. Grover search and 
the quantum walk based search algorithms of Ambainis, Szegedy and Magniez et 
al. will be stated as quantum analogues of classical search procedures. We present 
a rather detailed description of a somewhat simplified version of the MNRS al- 
gorithm. Finally, in the query complexity model, we show how quantum walks 
can be applied to the following search problems: Element Distinctness, Matrix 
Product Verification, Restricted Range Associativity, Triangle, and Group Com- 
mutativity. For a detailed introduction to quantum walks the reader is referred 
to the excellent surveys of Kempe [20 and Ambainis Another survey on 
quantum search algorithms is also due to Ambainis [B]. 

2 Classical search algorithms 

At an abstract level, any search problem may be cast as the problem of finding 
a marked element from a set X. Let M C A" be the set of marked elements, 
and let e be a known lower bound on |M|/|Ar|, the fraction of marked elements, 
whenever M is non-empty. If no further information is available on Af, we can 
choose £ as 1/|A|. The simplest approach, stated in Search Algorithm 1, to 
solve this problem is to repeatedly sample from X uniformly until a marked 
element is picked, if there is any. 



Search Algorithm 1 

Repeat for t — 0{\/£) steps 

1. Sample x & X according to the uniform distribution. 

2. If X is in M then output it and stop. 



More sophisticated approaches might use a Markov chain on the state space 
X for generating the samples. In that case, to generate the next sample, the 
resources expended for previous generations are often reused. 

Markov chains can be viewed as random walks on directed graphs with 
weighted edges. We will identify a Markov chain with its transition matrix 



P = (Pxy)- A chain is irreducible if every state is accessible from every other 
state. An irreducible chain is ergodic if it is also aperiodic. The eigenvalues of a 
Markov chain are at most 1 in magnitude. By the Perron- Frobenius theorem, an 
irreducible chain has a unique stationary distribution tt = (tTx), that is a unique 
left eigenvector tt with eigenvalue 1 and positive coordinates summing up to 1 . If 
the chain is ergodic, the eigenvalue 1 is the only eigenvalue of P with magnitude 
1. We will denote by ^ = 6{P) the eigenvalue gap of P, that is 1 — |A|, where 
A is an eigenvalue with the second largest magnitude. It follows that when P is 
ergodic then 5 > 0. 

The time-reversed Markov chain P* of P is defined by the equations iTxPxy = 
TTyPyx- The Markov chain P is said to be reversible if P* = P. Reversible chains 
can be viewed as random walks on undirected graphs with weighted edges, and 
in these chains the probability of a transition from a state x to another state y in 
the stationary distribution is the same as the probability of the transition in the 
reverse direction. The Markov chain P is symmetric ii P = P^ where P* denotes 
the transposed matrix of P. The stationary distribution of symmetric chains 
is the uniform distribution. They can be viewed as random walks on regular 
graphs, and they are time-reversible. 

We consider two search algorithms based on some ergodic and symmetric 
chain P. Search Algorithm 2 repeatedly samples from approximately sta- 
tionary distributions, and checks if the element is marked. To get a sample the 
Markov chain is simulated long enough to mix well. Search Algorithm 3 is a 
greedy variant: a check is performed after every step of the chain. 



Search Algorithm 2 

1. Initialize a; to a state sampled from the uniform distribution over X. 

2. Repeat ior t2 = 0{l/e) steps 

(a) If the element reached in the previous step is marked then output 
it and stop. 

(b) Simulate ti = 0{l/5) steps of P starting with x. 



Search Algorithm 3 

1. Initialize a; to a state sampled from the uniform distribution over X. 

2. Repeat for t = 0{l/e5) steps 

(a) If the element reached in the previous step is marked then output 
it and stop. 

(b) Simulate one step of P starting with x. 



We state formally the complexity of the three algorithms to clarify their 
differences. They will maintain a data structure d that associates some data d{x) 
with every state x G X. Creating and maintaining the data structure incurs 
a certain cost, but the data d{x) can be helpful to determine if x S M. We 
distinguish three types of cost. 



Setup cost S: The cost to sample x ^ X according to the uniform distri- 
bution, and to construct d{x). 

Update cost U: The cost to simulate a transition from a; to y according 
to P, and to update d{x) to d{y). 

Checking cost C: The cost of checking if x e M using d{x). 

The cost may be thought of as a vector listing all the measures of complexity of 
interest, such as query and time complexity. The generic bounds on the efficiency 
of the three search algorithms can be stated in terms of the cost parameters. 

Proposition 1. Let P he an ergodic and symmetric Markov chain on X . Then 
all three algorithms find a marked element with high probability if there is any. 
The respective costs incurred by the algorithms are of the following order: 

1. Search Algorithm 1.- (S + C)/e, 

2. Search Algorithm 2: S + (U/(5 + C)/£, 

3. Search Algorithm 3.- S + (U + C)/5e. 

The generic bound of 0(l/(5e) in Search Algorithm 3 on the hitting time 
is not always optimal, which in some cases, for example in the 2-dimensional 
grid, can be significantly smaller. 

3 Quantum analogue of a classical Markov chain 

We define a quantum analogue of an arbitrary irreducible Markov chain P as it is 
given by Magniez et al. 25j. This definition is based on and slightly extends the 
concept of quantum Markov chain due to Szegedy |35j . The latter was inspired 
by an earlier notion of quantum walk due to Ambainis [7]. We also point out 
that a similar process on regular graphs was studied by Watrous 13 7j . 

The quantum walk may be thought of as a walk on the edges of the original 
Markov chain, rather than on its vertices. Thus, its state space is a vector sub- 
space of H = C-^^-^ (g) C^. For a state G let 77^ = denote 
the orthogonal projector onto Span(|?/')), and let ref(';/') = 277^ — Id denote the 
reflection through the line generated by jV'), where Id is the identity operator 
on Ti. If /C is a subspace of Ti, spanned by a set of mutually orthogonal states 
{IV'i) : i G /}, then let ilyc = X^ie/ ^i'i the orthogonal projector onto /C, and 
let ref(/C) — 277;^— W be the reflection through /C. Let A = Span(|x)|pa;) : x G X) 
and B = Span{\p*)\y) : y G X) be vector subspaces of TC, where 



Definition 1 (Quantum walk). The unitary operation W (P) — Yei{B)-iei{A) 
defined on Ti. by is called the quantum walk based on the classical chain P. 

Let us give some motivations for this definition. Classical random walks do 
not quantize in the space of the vertices. The standard way advocated by several 
papers (see the survey [20]) is to extend the vertex space X by a coin space C, 
and define the state space of the walk as X xC. Then a step of the walk is defined 
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as the product of two unitary operations. The first one is the flip operation F 
controlled by the vertex state, which means that for every x Cz X, it performs 
a unitary coin flip on the states {|a;, c) : c G C}. For d-regular undirected 
graphs, C can be taken as the set {1, . . . , d}, and in that case the coin flip F^ is 
independent from x. The second one is the shift operation S which is controlled 
by the coin state, and takes a vertex to one if its neighboring vertices. For d- 
regular graphs the simplest way to define it is via a labeling of the directed edges 
by the numbers between 1 and d such that for every 1 < i < d, the directed 
edges labeled by i form a permutation. Then, if the coin state is i, the new vertex 
is the z**^ neighbor according to the labeling. For general walks it is practical to 
take the coin space also to be X, then the state space of the walk corresponds 
naturally to the directed edges of the graph. In this case there is a symmetry 
between the two spaces, and the shift operation simply exchanges the vertices, 
that is S\x,y) — for every x,y £ X. 

Let us pause here for a second and consider how a classical walk defined 
by some Markov chain P can be thought of as a walk on the directed edges 
of the graph (instead of the vertices). Let's think about an edge {x,u) as the 
state of the walk P being at x, where the previous state was u. According to 
this interpretation, in one step the walk on edges should move from state (x, u) 
to state {y,x) with probability p^y. This move can be accomplished by the 
stochastic flip operation F controlled by the left end-point of the edge, where 
F^y = pxy for all x,u,y e X, followed by the shift S defined previously. If we 
define the flip F' as F but controlled by the right end-point of the edge, then 
it is not hard to see that SFSF = F'F. Therefore one can get rid of the shift 
operations, and two steps of the walk can be accomplished by two successive 
flips where the control and the target registers alternate. 

Coming back to the quantization of classical walks, we thus want to find 
unitary coin flips which mirror the walk P, and which alternately mix the right 
end-point of the edges over the neighbors of the left end-point, and then the 
left end-point of the edges over the neighbors of the new right end-point. The 
reflections ref(^) and ref(S) are natural choices for that. They are also gener- 
alizations of the Grover diffusion operator [16J. Indeed, when the transition to 
each neighbor is equally likely, they correspond exactly to Grover diffusion. In 
Szegedy's original definition the alternating refiections were ref(^) and ref(S') 
with B' = Span{\py)\y) : y G X), mirroring faithfully the classical edge based 
walk. The reason why the MNRS quantization chooses every second step a re- 
flection based on the reversed walk P* is explained now. 

The eigen-spectrum of the transition matrix P plays an important role in 
the analysis of a classical Markov chain. Similarly, the behaviour of the quan- 
tum process W{P) may be inferred from its spectral decomposition. The reflec- 
tions through subspaces A and B are (real) orthogonal transformations, and so 
is their product W{P). An orthogonal matrix may be decomposed into a direct 
sum of the identity, reflection through the origin, and two-dimensional rotations 
over orthogonal vector subspaces [T71 Section 81]. These subspaces and the cor- 
responding eigenvalues are revealed by the singular value decomposition of the 



product Uji^nis of the orthogonal projection operators onto the subspaces A and 
B. Equivalently, as done by Szegedy, one can consider the singular values of the 
discriminant matrix D{P) = {yJPxyP*yx)- Since yJPxyP*yx = \/T^Pxyl ^/t^, we 
have 

D{P) = diag(7r)i/2 • P ■ diag(7r)-i/2, 

where diag(7r) is the invertible diagonal matrix with the coordinates of the dis- 
tribution TT in its diagonal. Therefore D{P) and P are similar, and their spectra 
are the same. When P is reversible then D{P) is symmetric, and its singular 
values are equal to the absolute values of its eigenvalues. Thus, in that case we 
only have to study the spectrum of P. 

Since the singular values of D{P) all lie in the range [0,1], they can be 
expressed as cos 6*, for some angles 9 S [0, The following theorem of Szegedy 
relates the singular value decomposition of D{P) to the spectral decomposition 
ofW{P). 

Theorem 1 (Szegedy [35j). Let P be an irreducible Markov chain, and let 
cos 01, . . . , cos 6i be an enumeration of those singular values (possibly repeated) 
of D{P) that lie in the open interval (0,1). Then the exact description of the 
spectrum of W{P) on A + B is: 

1. On A + B those eigenvalues ofW{P) that have non-zero imaginary part are 
exactly e^^'^^ , • ■ • , e^^'^' , with the same multiplicity. 

2. On An B the operator W{P) acts as the identity Id. An B is spanned by 
the left (and right) singular vectors of D{P) with singular value 1. 

3. OnAnB-^ andA^nB the operator W{P) acts as -Id. Ar\B^ (respectively, 
A'^ nB) is spanned by the left (respectively, right) singular vectors of D{P) 
with singular value 0. 

Let us now suppose in addition that P is ergodic and reversible. As we 
just said, reversibility implies that the singular values of D{P) are equal to the 
absolute values of the eigenvalues of P. From the ergodicity it also follows that 
D{P) has a unique singular vector with singular value 1. We have therefore the 
following corollary. 

Corollary 1. Let P be an ergodic and reversible Markov chain. Then, on A + B 
the spectrum ofW{P) can be characterized as: 

xex yex 

is the unique 1- eigenvector, e*^'^ are eigenvalues for every singular value cosO G 
(0,1) of D{P), and all the remaining eigenvalues are -L 

The phase gap A{P) = Z\ of W{P) is defined as 29, where 9 is the smallest 
angle in (0,^] such that cos6' is a singular value of D{P). This definition is 
motivated by the previous theorem and corollary: the angular distance of 1 from 
any other eigenvalue of W{P) on ^ + S is at least A. When P is ergodic and 



reversible, there is a quadratic relationship between the phase gap A of the 
quantum walk W{P) and the eigenvalue gap 6 of the classical Markov chain P, 
more precisely A > 2^/5. Indeed, let S G (0, f ] such that S ^ 1 — coaO and 
A ~ 29. The following (in)equalities can easily be checked: A > |l — e^'^| = 
2\/l — cos^ e > 2VS. The origin of the quadratic speed-up due to quantum 
walks may be traced to this phenomenon. 

4 Quantum search algorithms 

As in the classical case, the quantum search algorithms look for a marked ele- 
ment in a finite set X. We suppose that the elements of X are coded by binary 
strings and that 0, the everywhere string is in X. A data structure attached to 
both vertex registers is maintained during the algorithm. Again, three types of 
cost will be distinguished, generalizing those of the classical search. In all quan- 
tum search algorithms the overall complexity is of the order of these specific 
costs, which justifies their choices. The operations not involving manipulations 
of the data will be charged at unit cost. For the sake of simplicity, we do not 
formally include the data into the description of the unitary operations defining 
the costs. The initial state of the algorithm is explicitly related to the stationary 
distribution tt of P. 

(Quantum) Setup cost S: The cost for constructing the state 
J2xex V^\^)\^) with data. 

(Quantum) Update cost U: The cost to realize any of the unitary 
transformations and inverses with data 

my) ^ E.ex VpI^I^M- 

(Quantum) Checking cost C: The cost to realize the unitary transforma- 
tion with data, that maps \x) \y) to — \x) \y) if a; € M, and leaves it unchanged 
otherwise. 

In the checking cost we could have included the cost of the unitary transfor- 
mation which realizes a phase flip also when y G M, our choice was made just 
for simplicity. Observe that the quantum walk W{P) with data can be imple- 
mented at cost 4U -I- 2. Indeed, the reflection ref (^) is implemented by mapping 
states |a;)|pa;) to |a;)|0), applying ref(C'^ (g) |0)), and undoing the first transfor- 
mation. In our accounting we charge unit cost for the second step since it does 
not depend on the database. Therefore the implementation of rei{A) is of cost 
2U + 1. The reflection ref(S) may be implemented similarly. 

Let us now describe how the respective algorithms of Grover, Ambainis and 
Szegedy are related to the classical search algorithms of Section O We suppose 
that e, a lower bound on the proportion of marked elements is known in advance, 
though the results remain true even if it is not the case. Grover search (which 
we discuss soon in detail) is the quantum analogue of Search Algorithm 1. 



Theorem 2 (Grover [TBJ). There exists a quantum algorithm which with high 
probability finds a marked element, if there is any, at cost of order 

In the original application of Grover 's result to unordered search there is no 
data structure involved, therefore S + C = 0(1), and the cost is of order 

The algorithm of Ambainis is the quantum analogue of Search Algorithm 2 
in the special case of the walk on the Johnson graph and for some specific marked 
sets. Let us recall that for < r < n/2, the vertices of the Johnson graph J{n, r) 
are the subsets of \n] of size r, and there is an edge between two vertices if the 
size of their symmetric difference is 2. In other words, two vertices are adjacent 
if by deleting an element from the first one and adding a new element to it we 
get the second vertex. The eigenvalue gap 5 of the symmetric walk on J(n, r) 
is njr(n — r) = 0{l/r). If the set of marked vertices in J{n,r) is either empty, 
or it consists of vertices that contain a fixed subset of constant size k < r then 

Theorem 3 (Ambainis [7] ) . Let P be the random walk on the Johnson graph 
J{n,r) where r — o(n), and let M be either empty, or the class of vertices that 
contain a fixed subset of constant size k < r. Then there is a quantum algorithm 
that finds, with high probability, the k-subset if M is not empty at cost of order 

Szegedy's algorithm is the quantum analogue of Search Algorithm 3 for 
the class of ergodic and symmetric Markov chains. His algorithm is therefore 
more general than the one of Ambainis with respect to the class of Markov 
chains and marked sets it can deal with. Nonetheless, the approach of Ambainis 
has its own advantages: it is of smaller cost when C is substantially greater than 
U, and it also finds a marked element. 

Theorem 4 (Szegedy |35| ). Let P be an ergodic and symmetric Markov 
chain. There exists a quantum algorithm that determines, with high probability, 
if M is non-empty at cost of order S + :^^(U + C). 

The MNRS algorithm is a quantum analogue of Search Algorithm 2 for 
ergodic and reversible Markov chains. It generalizes the algorithms of Ambainis 
an Szegedy, and it combines their benefits in terms of being able to find marked 
elements, incurring the smaller cost of the two, and being applicable to a larger 
class of Markov chain. 

Theorem 5 (Magniez et al. [25j). Let P be an ergodic and reversible Markov 
chain, and let e > be a lower bound on the probability that an element chosen 
from the stationary distribution of P is marked whenever M is non-empty. Then, 
there exists a quantum algorithm which finds, with high probability, an element 
of M if there is any at cost of order S + ■^(■^U + C). 

There is an additional feature of Szegedy's algorithm which doesn't fit into 
the MNRS algorithmic paradigm. In fact, the quantity -h= in Theorem |4] can 



be replaced by the square root of the classical hittmg time [35_. The search 
algorithm for the 2-dimcnsional grid obtained this way, and the one given in [S] 
have smaller complexity than what follows from Theorem [5l 

5 The MNRS search algorithm 

We give a high level description of the MNRS search algorithm. Assume that 
M 7^ 0. Let M. = C*^^'^ denote the marked subspace, that is the subspace 
with marked items in the first register. The purpose of the algorithm is to ap- 
proximately transform the initial state [tt) to the target state which is the 
normalized projection of |7r) onto M: 

II^mWII ^/^;|^, 

where e = ||7T7vi|7r)|p — J^xem'^x is the probability of the set M of marked 
states under the stationary distribution tt. Let us recall that Grover search [IB] 
solves this problem via the iterated use of the rotation ref(7r) • ref(/i^) in the 
two-dimensional real subspace S — Span(|7r), where is the state in S 
orthogonal to making some acute angle ip with |7r). The angle ip is given 
by sin(p = = y/s. Then ref(7r) • ref(/i^) is a rotation by 2(p within the 

space S, and therefore 0{l/(p) — 0(l/^/e) iterations of this rotation, starting 
with Itt), approximates well The MNRS search basically follows this idea. 

Restricted to the subspace S, the operator ref(/i-'-) is identical to — ref(A^). 
Therefore, if the state of the algorithm remains close to the subspace S through- 
out, it can be implemented at the price of the checking cost. The reflection ref (tt) 
is computationally harder to perform. The idea is to apply the phase estimation 
algorithms of Kitaev [21] and Cleve at al. [13j to W{P). Corollary [T] implies 
that Itt) is the only 1-eigenvector of W{P), and all the other eigenvectors have 
phase at least A. Phase estimation approximately resolves any state in ^ + 
along the eigenvectors of W{P), and thus distinguishes [tt) from all the others. 
Therefore it is possible to flip the phase of all states with a non-zero estimate 
of the phase, that is simulate the effect of the operator ref(7r) in A + B. The 
following result of [25] resumes this discussion: 

Theorem 6. There exists a uniform family of quantum circuits R{P) that uses 
0(fc log(Zi^^)) additional qubits and satisfies the following properties: 

1. It makes 0{kA^^) calls to the controlled quantum walk c—W{P) and its 
inverse. 

2. i?(P) Itt) -Ivr). 

3. If\ip) (^A + B is orthogonal to \tt), then -|- Id)|?/')|| < 2-^. 

The essence of the MNRS search algorithm is the following simple procedure 
that satisfies the conditions of Theorem O but with a slightly higher complexity, 
of the order of S -|- 4=(-7t log -|- C). Again, we suppose that e is known. 



Quantum Search(P) 

1. Start from the initial state [tt). 

2. Repeat 0(l/-\/e) -times: 

(a) For any basis vector |2;)|y), flip the phase if x E M . 

(b) Apply circuit R{P) of Theorem [6] with k = 0(log(l/Ve)). 

3. Observe the first register and output if it is in M . 



To see the correctness, let \(j)i) be the result of i iterations of ref(7r) • ref(/i^) 
applied to [tt), and let be the result of i iterations of step (2) in Quantum 
Search(P) applied to |7r). It is not hard to show by induction on i, using a 
hybrid argument as in [10136] . that IllV'i) — 1^ 0{i2^'^). This implies that 
II IV'fc) — is an arbitrarily small constant when k is chosen to be O(log(l/y^)) 
and therefore the success probability is arbitrarily close to 1. 

The cost of the procedure is simple to analyze. Initialization costs S + U, and 
in each iteration the single phase flip costs C. In the circuit R{P), the controlled 
quantum walk and its inverse can be implemented, similarly to W{P), at cost 
4U + 2, simply by controlhng ref(C-^ (g) |0)) and ref(|0) (g) C^). The number of 
steps of the controlled quantum walk and its inverse is 0((1/Z\) log(l/y^)). Since 
A > this finishes the cost analysis. Observe that the log(l/Y^)-factor in the 
update cost was necessary for reducing the error of the approximate reflection 
operator. In |25j it is described how it can be eliminated by adapting the recursive 
amplitude amplification algorithm of H0yer et al. [18] 

6 Applications 

We give here a few examples where the quantum search algorithms, in particular 
the MNRS algorithm can be applied successfully. All examples will be described 
in the query model of computation. Here the input is given by an oracle, a query 
can be performed at unit cost, and all other computational steps are free. A 
formal description of the model can be found for example in [^ or [55]. In fact, 
in almost all cases, the circuit complexity of the algorithms given will be of the 
order of the query complexity, with additional logarithmic factors. 

6.1 Grover search 

As a first (and trivial) application, we observe that Grover's algorithm [16j for 
the unordered search problem is a special case of Theorem [Sj 

Unordered Search 

Oracle Input: A boolean function / defined on [n] . 
Output: An element i G [n] such that f{i) — 1. 

Theorem 7. Unordered Search can be solved with high probability in quan- 
tum query complexity 0{{n/k)^/'^), where \{i G [n] : f{i) ~ 1}| k. 



Proof. Consider the symmetric random walk in the complete graph on n vertices, 
where an element v is marked if f{v) = 1. The eigenvalue gap of the walk is 
1 — and the probability e that an element is marked is k/n. There is no 
data structure involved in the algorithm, the setup, update and checking costs 
are 1. 

6.2 Johnson graph based algorithms 

All these examples are based on the symmetric walk in the Johnson graph J{n, r), 
with eigenvalue gap 0{l/r). 

Element Distinctness This is the original problem for which Ambainis intro- 
duced the quantum walk based search method [7]. 

Element Distinctness 

Oracle Input: A function / defined on [n\. 

Output: A pair of distinct elements i,j G [n] such that f{i) = f{j) if 
there is any, otherwise reject. 

Theorem 8. Element Distinctness can be solved with high probability in 
quantum query complexity 0[n^/^). 

Proof. A vertex R C [n] of size r is marked if there exist i ^ j ^ R such 
/(*) = /(j)- The probability e that an element is marked, if there is any, is in 
i7((r/n)^). For every i?, the data is defined as {(w, /(«)) : v S i?}. Then the setup 
cost is in 0(r), the update cost is 0(1), and the checking cost is 0. Therefore 
the overall cost is 0{r + n/r^/^) which is 0{n^^^) when r = r?!"^ . This upper 
bound is tight, the Q[r?l'^') lower bound is due to Aaronson and Shi [1]. 

Matrix Product Verification This problem was studied by Buhrman and 
Spalek |12j . and the algorithm in the query model is almost identical to the 
previous one. 

Matrix Product Verification 

Oracle Input: Three n x n matrices A, B and C. 

Output: Decide if AB = C and in the negative case find indices i,j such 
that {AB)ij ^ C,j. 

Theorem 9. Matrix Product Verification can be solved with high proba- 
bility in quantum query complexity 0{n^/^). 

Proof. For an n x n matrix M and a subset of indices i? C [rt], let Mj/j denote 
the \R\ X n submatrix of M corresponding to the rows restricted to R. The 
submatrices M\^ and are defined similarly, when the restriction concerns 
the columns and both the rows and columns. A vertex R C [n] is marked if 
there exist i,j € R such that ABij ^ dj. The probability of being marked, if 



there is such an element, is in fi{{r /nf'). For every R, the data is defined as the 
set of entries in Aj/?, B\^ and C\^. Then the setup cost is in 0{rn), the update 
cost is 0{n), and the checking cost is 0. Therefore the overall cost is 0{n^^^) 
when r — v?^^ . The best known lower bound is fl[r?l'^\ and in [T^] an 0(n^/^) 
upper bound was also proven for the time complexity with a somewhat more 
complicated argument. 

Restricted Range Associativity The problem here is to decide if a binary 
operation o is associative. The only algorithm known for the general case is 
Grover search, but Dorn and Thierauf [15 have proved that when the range of 
the operation is restricted. Theorem [5] (or Theorem [3]) give a non-trivial bound. 
A triple (a, 6, c) is called non associative if (a o 6) o c 7^ a o (6 o c). 

Restricted Range Associativity 

Oracle Input: A binary operation o : [n] x [n] —f [k] where k € 0{1). 
Output: A non associative triple (a, 6, c) if there is any, otherwise reject. 

Theorem 10. Restricted Range Associativity can be solved with high 
probability in quantum query complexity 0{n^^^). 

Proof. We say that R C [n] is marked if there exist a,b £ R and c e [n] such 
that (a, 5, c) is non associative. Therefore e is in f2{{r/n)'^), if there is a marked 
element. For every R Q [n], the data structure is defined as {(a, 6, a o 6) : a,b G 
R U [k]}. Then the setup cost is 0((r + fc)^ — 0{r^) and the update cost is 
0{r + k) = 0{r). Observe that if G i? and c G [n] are fixed, then computing 
{aoh)oc and ao (boc) for all a G i? requires at most fc + 1 queries with the help of 
the data structure. Thus using Grover search to find b and c, the checking cost is 
0{ky/rn) = 0{y/rn). The overall complexity is then Oir"^ + ^{y/rr+y/rn)) which 
is 0(n^/^) when r = ^/n. The best lower bound known both in the restricted 
range and the general case is il{n). 

Triangle In an undirected graph G, a complete subgraph on three vertices is 
called a triangle. The algorithm of Magniez et al. 126] for finding a triangle uses 
the algorithm for Element Distinctness in the checking procedure. 

Triangle 

Oracle Input: The adjacency matrix / of a graph G on vertex set [n]. 
Output: A triangle if there is any, otherwise reject. 



Theorem 11. Triangle can be solved with high probability in quantum query 
complexity 0(71^^/^"). 

Proof. We show how to find the edge of a triangle, if there is any, in query 
complexity 0(n^^/^°). This implies the theorem since given such an edge, Grover 
search finds the third vertex of the triangle with 0(n^/^) additional queries. 



An element R C [n] is marked if it contains a triangle edge. The probability 
e that an element is marked is in f2((r/n)^), if there is a triangle. For every 
R, the data structure is the adjacency matrix of the subgraph induced by R. 
defined as {{v, f{v)) : v e R}. Then the setup cost is 0{r^), and the update cost 
is 0{r). The interesting part of the algorithm is the checking procedure, which 
is a quantum walk based search itself, and the claim is that it can be done at 
cost 0{y/n X r^/-^). 

To see this, let i? be a set of r vertices such that the graph G restricted to 
R is explicitly known, and for which we would like to decide if it is marked. 
Observe that R is marked exactly when there exists a vertex v e [n] such that 
V and an edge in R form a triangle. Therefore for every vertex v, one can define 
a secondary search problem on R via the boolean oracle /i,, where for every 
u G i?, by definition fv{u) — 1 if {u, v} is an edge. The output of the problem is 
by definition positive if there is an edge {u, u'} such that fv{u) = fv{u') = 1. To 
solve the problem we consider the Johnson graph J(r, r^^^), and look for a subset 
which contains such an edge. In that search problem both the probability of being 
marked and the eigenvalue gap of the underlying Markov chain are in /2(r~^/^). 
The data associated with a subset of R is just the values of /„ at its elements. 
Then the setup cost is r^^"^, the update cost is 0(1), and the checking cost is 
0. Therefore by Theorem [5] the cost of solving a secondary search problem is in 
Qf^j,2/3y Finally the checking procedure of the original search problem consists 
of a Grover search for a vertex v such that the secondary search problem defined 
by /„ has a positive outcome. Putting things together, the problem can be solved 
in quantum query complexity 0{r^ + 'j{^/r x r + x r^/^)) which is 0(n^'^/^°) 
when r = n^^^. The best known lower bound for the problem is i7(n). 

6.3 Group commutativity 

The problem here is to decide if a group multiplication is commutative in the 
(sub)group generated by some set of group elements. It was defined and studied 
in the probabilistic case by Pak |31| . the quantum algorithm is due to Magniez 
and Nayak [53]. 

Group Commutativity 

Oracle Input: The multiplication operation o for a finite group whose 
base set contains [n]. 

Output: A non commutative couple G [n] x [n] if G, the (sub)group 
generated by [n], is non-commutative, otherwise reject. 

Theorem 12. Group Commutativity can be solved with high probability in 
quantum query complexity 0{n^^^logn). 

Proof. For < r < n let S{n, r) be the set of all r-tuples of distinct elements 
from [n]. For u — (ui, . . . , Ur) in 5(n, r), we set u — ui o ■ ■ ■ o Ur- We define 
a random walk over S{n, r). Let u = (wi, . . . , Ur) be the current vertex. Then 
with probability 1/2 stay at u, and with probability 1/2 pick uniformly random 



i G [r] and j G [n\. If j = u,n for some m then exchange Ui and otherwise 
set Ui = j. The random walk P at the basis of the quantum algorithm is over 
S{n,r) X S{n,r), and it consists of two independent simultaneous copies of the 
above walk. The stationary distribution of P is the uniform distribution, and it 
is proven in [23] that its eigenvalue gap is f2(l/(r logr)). 

A vertex {u, v) is marked if m o ^ u o u. It is proven again in |23| that when 
G is non-commutative and r G o(n), then the probability e that an element is 
marked is 6?(r^/n^). For u G S{n,r) let T.^ be the balanced binary tree with r 
leaves that are labeled from left to right by ui, . . . ,Ur, and where each internal 
node is labeled by the product of the labels of its two sons. For every vertex 
(u, v) the data consists of (T„, Ty). Then the setup cost is r, and the update cost 
is O(logr) for recomputing the leaf-root paths. The checking cost is simply 2 for 
querying uov and vou. Therefore the query complexity to find a marked element 
is 0{r + ^{y/r log r log r + 1)) which is 0(n^/'^logn) when r — 7i^/'^logn. Once 
a marked element is found, Grover search yields a non-commutative couple at 
cost 0{r). In [23j an {2{n^^^) lower bound is also proven. And, it turns out that 
a Johnson graph based walk can be applied to this problem too [24] , yielding an 
algorithm of complexity 0((n log n)^/'^). 
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